Skip to content

Commit 4f9fc40

Browse files
miklpottermiklpotter
authored
Update 080_rule_criteria_merge.sql
#30 incorporate hanielburton fix into script
1 parent 7b61bbb commit 4f9fc40

File tree

1 file changed

+84
-95
lines changed

1 file changed

+84
-95
lines changed

‎product/sert/sert_core/seed_data/080_rule_criteria_merge.sql‎

Lines changed: 84 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -10,101 +10,90 @@
1010
-- This script needs to run AFTER rule_criteria_types_merge
1111
-- It converts the criteria type KEY into the criteria_type_id value so that
1212
-- the script does not rely on ID which could change on different environments
13+
-- script update from github hanielburton
14+
-- RULE_CRITERIA table was empty after installing on Autonomous.
15+
-- After fully escaping special characters, I was able parse the JSON and re-wrote the merge so it happens in a single SQL statement
16+
-- (makes it easier to copy out the using clause and test that it parses) instead of a loop
1317
-- ---------------------------------------------------------------------------
14-
declare
15-
l_json clob;
16-
l_rule_criteria_type_id sert_core.rule_criteria_types.rule_criteria_type_id%type;
17-
begin
18-
-- Load data in JSON object
19-
l_json := q'!
20-
[
21-
22-
{"ruleCriteriaName" : "Incorrect Item Substitution Syntax",
23-
"ruleCriteriaKey" : "INCORRECT_ITEM_SUBSTITUTION_SYNTAX_SQLI",
24-
"ruleCriteriaTypeKey" : "SQLI",
25-
"ruleCriteriaSQL" : "with string as ( select :l_source as s from dual) select count(*) from string where (REGEXP_LIKE((string.s), '&[[:alnum:]]+.', 'ix') and REGEXP_INSTR(string.s,'&+\w+(!STRIPHTML.)',1,1,0,'i') = 0)",
26-
"reason" : "Incorrect item substitution syntax"},
27-
{"ruleCriteriaName" : "Usage of EXECUTE IMMEDIATE",
28-
"ruleCriteriaKey" : "USAGE_OF_EXECUTE_IMMEDIATE",
29-
"ruleCriteriaTypeKey" : "SQLI",
30-
"ruleCriteriaSQL" : "select count(*) from dual where REGEXP_LIKE((:l_source), 'EXECUTE+[ ]+IMMEDIATE', 'i')",
31-
"reason" : "EXECUTE IMMEDIATE found; please investigate"},
32-
{"ruleCriteriaName" : "Usage of DBMS_SQL",
33-
"ruleCriteriaKey" : "USAGE_OF_DBMS_SQL",
34-
"ruleCriteriaTypeKey" : "SQLI",
35-
"ruleCriteriaSQL" : "select count(*) from dual where REGEXP_LIKE((:l_source), 'dbms_sql', 'i')",
36-
"reason" : "DBMS_SQL found; please investigate"},
37-
{"ruleCriteriaName" : "Usage of HTP without SYS prefix",
38-
"ruleCriteriaKey" : "USAGE_OF_HTP_WITHOUT_SYS_PREFIX",
39-
"ruleCriteriaTypeKey" : "SQLI",
40-
"ruleCriteriaSQL" : "with string as (select :l_source as s from dual) select regexp_count(string.s,'htp\\.',1,'i') - regexp_count(string.s,'(^[^(a-z_0-9)]?|[^(a-z_0-9)])sys\\.htp\\.',1,'i') DIFF from string",
41-
"reason" : "Be sure to include the SYS prefix when making calls to HTP"},
42-
{"ruleCriteriaName" : "Incorrect Item Substitution Syntax",
43-
"ruleCriteriaKey" : "INCORRECT_ITEM_SUBSTITUTION_SYNTAX_XSS",
44-
"ruleCriteriaTypeKey" : "XSS_ITEM_SYNTAX",
45-
"ruleCriteriaSQL" : "with string as ( select :l_source as s from dual) select count(*) from string where (REGEXP_LIKE((string.s), '&[[:alnum:]]+.', 'ix') and REGEXP_INSTR(string.s,'&+\w+(!STRIPHTML.)',1,1,0,'i') = 0)",
46-
"reason" : "Incorrect item substitution syntax"},
47-
{ "ruleCriteriaName" : "Hidden Item Value Protected",
48-
"ruleCriteriaKey" : "HIDDEN_ITEM_VALUE_PROTECTED",
49-
"ruleCriteriaTypeKey" : "HIDDEN_ITEM_VALUE_PROTECTED",
50-
"ruleCriteriaSQL" : "select count(*) from dual where json_value(:l_source,'$.VALUE_PROTECTED') = 'N'",
51-
"reason" :"Value Protected is set to No"
52-
}
53-
]
54-
55-
]!';
56-
57-
for data in (
58-
select *
59-
from json_table(l_json, '$[*]' columns
60-
RULE_CRITERIA_NAME varchar2(250) path '$.ruleCriteriaName'
61-
, RULE_CRITERIA_KEY varchar2(250) path '$.ruleCriteriaKey'
62-
, RULE_CRITERIA_TYPE_KEY varchar2(250) path '$.ruleCriteriaTypeKey'
63-
, RULE_CRITERIA_SQL varchar2(4000) path '$.ruleCriteriaSQL'
64-
, REASON varchar2(4000) path '$.reason'
65-
66-
)
67-
) LOOP
68-
select rule_criteria_type_id
69-
into l_rule_criteria_type_id
70-
from sert_core.rule_criteria_types
71-
where rule_criteria_type_key = data.rule_criteria_type_key;
72-
73-
merge into sert_core.rule_criteria dest
74-
using (
75-
select
76-
data.rule_criteria_key rule_criteria_key
77-
from dual
78-
) src
79-
on (1 = 1
80-
and dest.rule_criteria_key = src.rule_criteria_key
81-
)
82-
when matched then
83-
update
84-
set
85-
dest.rule_criteria_name = data.rule_criteria_name
86-
, dest.rule_criteria_type_id = l_rule_criteria_type_id
87-
, dest.rule_criteria_sql = data.rule_criteria_sql
88-
, dest.reason = data.reason
89-
90-
when not matched then
91-
insert (
92-
rule_criteria_name
93-
, rule_criteria_type_id
94-
, rule_criteria_sql
95-
, reason
96-
, rule_criteria_key
97-
18+
merge into sert_core.rule_criteria dest
19+
using (
20+
with
21+
json_data as (
22+
select
23+
q'!
24+
[
25+
{"ruleCriteriaName" : "Incorrect Item Substitution Syntax",
26+
"ruleCriteriaKey" : "INCORRECT_ITEM_SUBSTITUTION_SYNTAX_SQLI",
27+
"ruleCriteriaTypeKey" : "SQLI",
28+
"ruleCriteriaSQL" : "with string as ( select :l_source as s from dual) select count(*) from string where (REGEXP_LIKE((string.s), \u0027\u0026[[:alnum:]]+.\u0027, \u0027ix\u0027) and REGEXP_INSTR(string.s,\u0027\u0026+\u005Cw+(!STRIPHTML.)\u0027,1,1,0,\u0027i\u0027) = 0)",
29+
"reason" : "Incorrect item substitution syntax"},
30+
{"ruleCriteriaName" : "Usage of EXECUTE IMMEDIATE",
31+
"ruleCriteriaKey" : "USAGE_OF_EXECUTE_IMMEDIATE",
32+
"ruleCriteriaTypeKey" : "SQLI",
33+
"ruleCriteriaSQL" : "select count(*) from dual where REGEXP_LIKE((:l_source), \u0027EXECUTE+[ ]+IMMEDIATE\u0027, \u0027i\u0027)",
34+
"reason" : "EXECUTE IMMEDIATE found; please investigate"},
35+
{"ruleCriteriaName" : "Usage of DBMS_SQL",
36+
"ruleCriteriaKey" : "USAGE_OF_DBMS_SQL",
37+
"ruleCriteriaTypeKey" : "SQLI",
38+
"ruleCriteriaSQL" : "select count(*) from dual where REGEXP_LIKE((:l_source), \u0027dbms_sql\u0027, \u0027i\u0027)",
39+
"reason" : "DBMS_SQL found; please investigate"},
40+
{"ruleCriteriaName" : "Usage of HTP without SYS prefix",
41+
"ruleCriteriaKey" : "USAGE_OF_HTP_WITHOUT_SYS_PREFIX",
42+
"ruleCriteriaTypeKey" : "SQLI",
43+
"ruleCriteriaSQL" : "with string as (select :l_source as s from dual) select regexp_count(string.s,\u0027htp\u005C\u005C.\u0027,1,\u0027i\u0027) - regexp_count(string.s,\u0027(^[^(a-z_0-9)]?|[^(a-z_0-9)])sys\u005C\u005C.htp\u005C\u005C.\u0027,1,\u0027i\u0027) DIFF from string",
44+
"reason" : "Be sure to include the SYS prefix when making calls to HTP"},
45+
{"ruleCriteriaName" : "Incorrect Item Substitution Syntax",
46+
"ruleCriteriaKey" : "INCORRECT_ITEM_SUBSTITUTION_SYNTAX_XSS",
47+
"ruleCriteriaTypeKey" : "XSS_ITEM_SYNTAX",
48+
"ruleCriteriaSQL" : "with string as ( select :l_source as s from dual) select count(*) from string where (REGEXP_LIKE((string.s), \u0027\u0026[[:alnum:]]+.\u0027, \u0027ix\u0027) and REGEXP_INSTR(string.s,\u0027\u0026+\u005Cw+(!STRIPHTML.)\u0027,1,1,0,\u0027i\u0027) = 0)",
49+
"reason" : "Incorrect item substitution syntax"},
50+
{ "ruleCriteriaName" : "Hidden Item Value Protected",
51+
"ruleCriteriaKey" : "HIDDEN_ITEM_VALUE_PROTECTED",
52+
"ruleCriteriaTypeKey" : "HIDDEN_ITEM_VALUE_PROTECTED",
53+
"ruleCriteriaSQL" : "select count(*) from dual where json_value(:l_source,\u0027$.VALUE_PROTECTED\u0027) = \u0027N\u0027",
54+
"reason" :"Value Protected is set to No"
55+
}
56+
]!' rule_criteria
57+
from dual
58+
)
59+
select
60+
jt.*
61+
, rct.rule_criteria_type_id
62+
from
63+
json_data,
64+
json_table(
65+
json_data.rule_criteria, '$[*]'
66+
columns
67+
RULE_CRITERIA_NAME varchar2(250) path '$.ruleCriteriaName'
68+
, RULE_CRITERIA_KEY varchar2(250) path '$.ruleCriteriaKey'
69+
, RULE_CRITERIA_TYPE_KEY varchar2(250) path '$.ruleCriteriaTypeKey'
70+
, RULE_CRITERIA_SQL varchar2(4000) path '$.ruleCriteriaSQL'
71+
, REASON varchar2(4000) path '$.reason'
72+
) jt,
73+
sert_core.rule_criteria_types rct
74+
where
75+
rct.rule_criteria_type_key = jt.rule_criteria_type_key
76+
) src
77+
on (1=1 and dest.rule_criteria_key = src.rule_criteria_key)
78+
when matched then
79+
update set
80+
dest.rule_criteria_name = src.rule_criteria_name
81+
, dest.rule_criteria_type_id = src.rule_criteria_type_id
82+
, dest.rule_criteria_sql = src.rule_criteria_sql
83+
, dest.reason = src.reason
84+
when not matched then
85+
insert (
86+
rule_criteria_name
87+
, rule_criteria_type_id
88+
, rule_criteria_sql
89+
, reason
90+
, rule_criteria_key
9891
)
9992
values (
100-
data.rule_criteria_name
101-
, l_rule_criteria_type_id
102-
, data.rule_criteria_sql
103-
, data.reason
104-
, data.rule_criteria_key
105-
);
106-
end loop;
107-
108-
end;
109-
/
110-
--rollback not required
93+
src.rule_criteria_name
94+
, src.rule_criteria_type_id
95+
, src.rule_criteria_sql
96+
, src.reason
97+
, src.rule_criteria_key
98+
);
99+
--rollback not required

0 commit comments

Comments
 (0)